How can I protect a ClickOnce deployed application with a password? Do I have to change the IIS settings of the web or is there a way to do it programmatically?
I'm not sure it can be done. I may be wrong, but I didn't think that would work. Apart from anything else, even if your user puts in their credentials to get the .application, the runtime then does separate downloading, for which it needs anonymous access.
If you want to protect the client so much, you may have to come up with a different way of deploying it.